This storyboard shows plots based on open data about education that bear on Scotland’s cyber resilience from secondary school onwards. There are three types of education included:
Material every student should learn to protect themselves. Of the qualifications covered, currently only Cyber Security Fundamentals at SCQF Level 4 falls into this category.
Cyber security qualifications. These are sufficient for entry-level technical cyber security jobs. Statistics for them are still in their infancy because the subject coding that pulls them out is still not fully deployed.
Computing qualifications. While it is hard to derive good cyber security statistics, checking the state of computing qualifications in general is still the closest we can get.
In addition, we include a plot of research income in computing. A strong research community is required to compete for future PhD students.
The data sources behind this report change once a year. This version uses the data that was available at 1 May 2023.
Data source: Scottish Qualifications Authority
The data gives the number of Awards in Cyber Security Fundamentals attained at SCQF Level 4.
Attainment is counted against a year if the award was achieved before August of that year. That is, for 2022, the award was made between 1 Aug 2021 and 31 July 2022.
Data source: Scottish Qualifications Authority
The data gives the number of National Progression Awards in Cyber Security attained at SCQF Levels 4-6.
Attainment is counted against a year if the award was achieved before August of that year. That is, for 2022, the award was made between 1 Aug 2021 and 31 July 2022.
Data source: Scottish Qualifications Authority
The data gives the number of Highers and Advanced Highers attained in the years 2018-2022.
Attainment is counted against a year if the award was achieved before August of that year. That is, for 2022, the award was made between 1 Aug 2021 and 31 July 2022.
Data source: Scottish Government
From this data source, we use:
Note that this data gives the number of teachers with Computing Studies as their main subject, not all teachers of Computing Studies.
Data source: Scottish Funding Council
The data gives the number of students newly enrolling for a higher education qualification in a computing discipline at Scottish universities and further education colleges. From 2019-20, the subject code used is “Computing”; before this time, it is “Computer Science”.
Data source: Scottish Funding Council
The data gives the total number of students studying for a higher education qualification in a computing discipline at Scottish universities and further education colleges over all years - unlike other statistics based on entrants or qualifiers. From 2019-20, the subject code used is “Computing”; before this time, it is “Computer Science”.
Data source: Scottish Funding Council
The data gives the total number of students studying for a higher education qualification in a computing discipline at Scottish universities and further education colleges over all years - unlike other statistics based on entrants or qualifiers. From 2019-20, the subject code used is “Computing”; before this time, it is “Computer Science”.
Data source: Scottish Funding Council
The data gives the total number of students studying for a higher education qualification in a computing discipline at Scottish universities and further education colleges over all years - unlike other statistics based on entrants or qualifiers. From 2019-20, the subject code used is “Computing”; before this time, it is “Computer Science”.
Data source: Scottish Funding Council
The data gives the number of students gaining sub-degree, first degree, or postgraduate qualifications in Computing at Scottish universities and further education colleges. From 2019-20, the subject code used is “Computing”; before this time, it is “Information technology”.
59% of all UK courses declared for academic year 2023/24 lack HECOS codes. Where a course has a HECoS code but not one from our list of cyber security, it could be miscoded.
| HEI | Course | Aim | Mode | Foundation | Sandwich | Year Abroad | Coded as Cyber? | Code | URL |
|---|---|---|---|---|---|---|---|---|---|
| Abertay University | Cybersecurity | BSc | full-time | not available | not available | optional | yes | 100376 | https://www.abertay.ac.uk/course-search/undergraduate/cybersecurity/ |
| Abertay University | Ethical Hacking | BSc | full-time | not available | not available | optional | no | https://www.abertay.ac.uk/course-search/undergraduate/ethical-hacking/ | |
| Edinburgh Napier University | Computer Systems & Networks | BEng (Hons) | full-time | not available | optional | optional | yes | 100365 | http://www.napier.ac.uk/courses/beng-hons-computer-systems-and-networks-undergraduate-fulltime |
| Edinburgh Napier University | Computer Systems & Networks | BEng (Hons) | part-time | not available | optional | optional | yes | 100365 | http://www.napier.ac.uk/courses/beng-hons-computer-systems-and-networks-undergraduate-fulltime |
| Edinburgh Napier University | Cybersecurity & Forensics | BEng (Hons) | full-time | not available | optional | optional | yes | 100376 | https://www.napier.ac.uk/courses/beng-hons-cybersecurity-and-forensics-undergraduate-fulltime |
| Glasgow Caledonian University | Cyber Security and Networks | BSc (Hons) | full-time | not available | optional | not available | no | http://www.gcu.ac.uk/kis/11CYBSNT | |
| Glasgow Caledonian University | Digital Security and Forensics | BSc (Hons) | full-time | not available | optional | not available | no | http://www.gcu.ac.uk/kis/11DSFORS | |
| Heriot-Watt University | Computer Science (Cyber Security) | BSc (Hons) | full-time | not available | not available | not available | no | https://www.hw.ac.uk/uk/study/undergraduate/computer-science-cyber-security.htm | |
| Robert Gordon University | Cyber Security | BSc (Hons) | full-time | not available | optional | optional | no | http://www4.rgu.ac.uk/coursedb/disp_course_info.cfm?courseid=19765 | |
| The Open University | Cyber Security | BSc (Hons) | part-time | not available | not available | not available | no | http://www.open.ac.uk/courses/R60-learning-outcomes#teaching-learning-and-assessment-methods | |
| The Open University | Network Engineering | DipHE | part-time | not available | not available | not available | no | 100367 | http://www.open.ac.uk/courses/W19-learning-outcomes#teaching-learning-and-assessment-methods |
| University of the West of Scotland | Computer Networking | BSc (Hons) | full-time | not available | optional | not available | no | https://www.uws.ac.uk/study/undergraduate/undergraduate-course-search/computer-networking/ | |
| University of the West of Scotland | Computer Networking | BSc (Hons) | part-time | not available | optional | not available | no | https://www.uws.ac.uk/study/undergraduate/undergraduate-course-search/computer-networking/ | |
| University of the West of Scotland | Cyber Security | BEng (Hons) | full-time | not available | optional | optional | no | https://www.uws.ac.uk/study/undergraduate/undergraduate-course-search/cyber-security/ | |
| University of the West of Scotland | Cyber Security | MEng (Hons) | full-time | not available | optional | optional | yes | 100376 | https://www.uws.ac.uk/study/undergraduate/undergraduate-course-search/cyber-security/ |
| University of the West of Scotland | Cyber Security | BEng (Hons) | part-time | not available | optional | optional | no | https://www.uws.ac.uk/study/undergraduate/undergraduate-course-search/cyber-security/ | |
| University of the West of Scotland | Cyber Security | MEng (Hons) | part-time | not available | optional | optional | yes | 100376 | https://www.uws.ac.uk/study/undergraduate/undergraduate-course-search/cyber-security/ |
Data source: Higher Education Statistics Authority, Unistats record 2022/23
This source lists undergraduate university courses that universities have declared will be run in 2023/24. Because this information is prospective, it is subject to change. The source uses the new HECoS subject codes but most courses still do not complete this part of the return.
We consider the following codes to represent the bulk of cyber security education:
| HECoS Code | HECoS Label |
|---|---|
| 100365 | computer networks |
| 100376 | computer and information security |
| 100385 | computer forensics |
Although it would be possible to teach computer networks without substantive cyber security content, this is unlikely. In practice, many employers are happy to hire students with good networking backgrounds for specialist cyber security job roles.
We identify cyber courses by looking for any with these codes or with titles that match any of the following patterns as words or parts of words:
Titles are provided in the data as supplied by the university without further validation; any spelling mistakes will mean the course is not picked up in the search. The search can potentially return irrelevant results - for instance, food security courses and forensics courses that are completely about chemistry.
Data source: Higher Education Statistics Authority
These counts are for total students - that is, students in any year of their studies.
Data source: Higher Education Statistics Authority
Note that this data source does not use the new HECoS codes that allow cyber security students to be identified. Cyber security students codes fall into the following subjects:
| HECoS Code | HECoS Label | CAH3 Code | CAH3 label |
|---|---|---|---|
| 100365 | computer networks | 11-01-01 | computer science |
| 100376 | computer and information security | 11-01-04 | software engineering |
| 100385 | computer forensics | 11-01-08 | others in computing |
Data source: Higher Education Statistics Authority
Data source: Higher Education Statistics Authority
Table 54 shows students completing qualifications at UK higher education institutions by domicile, or country of home address. The table provides the number of full-person equivalent students at UK higher education institutions by subject of study. If a student’s course is split across subjects, only a proportion of that student will count towards the numbers.
HECoS contains the following codes that we consider to be core cyber security subjects. Although it would be possible to teach computer networks without substantive cyber security content, this is unlikely. In practice, many employers are happy to hire students with good networking backgrounds for specialist cyber security job roles.
| HECoS Code | HECoS Label |
|---|---|
| 100365 | computer networks |
| 100376 | computer and information security |
| 100385 | computer forensics |
We assume these numbers are artificially low, as not all courses currently have HECoS codes.
Data source: Higher Education Statistics Authority
Table 54 shows students completing qualifications at UK higher education institutions by domicile, or country of home address. The table provides the number of full-person equivalent students at UK higher education institutions by subject of study. If a student’s course is split across subjects, only a proportion of that student will count towards the numbers.
The HECoS coding system does not specifically identify the set of computing disciplines. We use the mapping between HECoS codes and the CAH system to construct the set. In the CAH system, computing disciplines are all CAH area 11.
Data source: Higher Education Statistics Authority
Table 54 shows students completing qualifications at UK higher education institutions by domicile, or country of home address. The table provides the number of full-person equivalent students at UK higher education institutions by subject of study. If a student’s course is split across subjects, only a proportion of that student will count towards the numbers.
The HECoS coding system does not specifically identify the set of computing disciplines. We use the mapping between HECoS codes and the CAH system to construct the set. In the CAH system, computing disciplines are all CAH area 11. Cyber security subjects are starred and listed first.
Cyber security research postgraduates are probably currently coded as “100366 Computer science”. The reason for this is not clear.
Data source: Skills Development Scotland
The data describes “uptake” of the Graduate Apprenticeships in Cyber Security at Scottish Credit and Qualifications Framework levels 10 and 11. Although the data set does not specify, the accompanying reporting suggests that the numbers reported are for enrolments, i.e., those starting the programmes.
The number of full-time equivalent Scottish computing academics grew by 25% from 2014/15 to 2021/22. This is compared to 15% for Scottish academics of all disciplines and 32% for UK computing academics.
Data source: Higher Education Statistics Authority
In the data, academic staff are categorised by cost centres that represent a cluster of academic disciplines. This analysis uses the cost centre “121 IT, systems sciences & computer software engineering”. It is not possible to get finer disciplines for staff from the open data.
The HESA records cover those with contracts of employment or where the higher education provider is required to pay Class 1 National Insurance contributions. Atypical staff have working arrangements that are not permanent or where there is a complex employment relationship. It is possible for institutions to do teaching using personnel who are not included, for instance, if they are out-sourced or self-employed.
Data source: Higher Education Statistics Authority
In the data, academic staff are categorised by cost centres that represent a cluster of academic disciplines. This analysis uses the cost centre “121 IT, systems sciences & computer software engineering”. It is not possible to get finer disciplines for staff from the open data.
The HESA records cover those with contracts of employment or where the higher education provider is required to pay Class 1 National Insurance contributions. Atypical staff have working arrangements that are not permanent or where there is a complex employment relationship. It is possible for institutions to do teaching using personnel who are not included, for instance, if they are out-sourced or self-employed. We omit institutions that report zero staff with employment contracts.
49% of Scottish computer science academics work part-time. This compares to 36% for Scottish academics of all disciplines and 32% for UK computing academics. The average part-time academic contributes 21% of an FTE.
Data source: Higher Education Statistics Authority
In the data, academic staff are categorised by cost centres that represent a cluster of academic disciplines. This analysis uses the cost centre “121 IT, systems sciences & computer software engineering”. It is not possible to get finer disciplines for staff from the open data.
The HESA records cover those with contracts of employment or where the higher education provider is required to pay Class 1 National Insurance contributions. Atypical staff have working arrangements that are not permanent or where there is a complex employment relationship. It is possible for institutions to do teaching using personnel who are not included, for instance, if they are out-sourced or self-employed.
43% of Scottish computer science academics are from the UK. This compares to 62% for Scottish academics of all disciplines and 53% for UK computing academics.
Data source: Higher Education Statistics Authority
In the data, academic staff are categorised by cost centres that represent a cluster of academic disciplines. This analysis uses the cost centre “121 IT, systems sciences & computer software engineering”. It is not possible to get finer disciplines for staff from the open data.
The HESA records cover those with contracts of employment or where the higher education provider is required to pay Class 1 National Insurance contributions. Atypical staff have working arrangements that are not permanent or where there is a complex employment relationship. It is possible for institutions to do teaching using personnel who are not included, for instance, if they are out-sourced or self-employed.
Data source: Higher Education Statistics Authority
The cost centre for computing disciplines is “121 IT, systems sciences and computer software engineering”.